Common GDPR Mistakes: What to Avoid According to EU Regulators

Update: October 2026

Since 2020, European data protection authorities have run coordinated investigations on this topic, and the EDPB has published its findings. The findings show where organisations of every size go wrong, and the same problems can recur.

This guide covers five mistakes drawn from those reports and from the GDPR itself, with the fix for each.

Key Takeaways

• The EDPB’s reports on the right of access (2025) and the right to erasure (2026) both found a lack of documented internal procedures for handling data subject requests. The first fix is a written procedure that staff can follow.

• The EDPB’s report on data protection officers found that some DPOs lack resources, expert knowledge, independence or access to the highest management. The role requires a DPO to have time, budget, and a direct line to senior management.

• A personal data breach that is likely to result in a risk to people must be reported to the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it. People are told directly only when the risk to them is high.

Regulators Now Investigate the Same Topic Across Europe at Once

The EDPB created its Coordinated Enforcement Framework in October 2020 to improve enforcement and cooperation between authorities. Each year, authorities pick one topic, send the same questionnaire to controllers, and report the combined results. So far the topics have been cloud services in the public sector, data protection officers, the right of access and the right to erasure.

These reports are the best available evidence of what goes wrong in practice, and they come from regulators who can open formal investigations. A mistake that appears in all of them deserves attention first.

1. Having Policies on Paper and No Working Procedure

The most repeated finding is a missing process. In its 2025 report on the right of access, the EDPB identified seven challenges across 1,185 responding controllers, including a lack of documented internal procedures for handling access requests. The 2026 report on the right to erasure, based on 764 controllers, found the same gap. It also found missing or inadequate staff training and too little information about how controllers handle requests.

The access report adds two further examples. Some controllers relied on exceptions to automatically refuse access requests, and some created barriers for individuals, such as formal requirements or requests for excessive identification documents.

The fix is a short written procedure for each data subject right. It should name who receives requests, how to log the date, how to confirm identity proportionately, who searches which systems, who decides on exceptions, and who sends the reply. Customer service and HR staff need training to spot a request and know where to send it. Our guide to responding to a subject access request walks through the steps.

2. Appointing a DPO Without Time, Resources or Independence

The EDPB’s 2024 report on the designation and position of DPOs drew on investigations by 25 authorities and more than 17,000 replies. The EDPB lists the concerns it found: DPOs not designated even where designation is mandatory; insufficient resources or expert knowledge; DPOs not fully entrusted with the tasks the law gives them; and a lack of independence or reporting to the highest management.

The results were also encouraging. Most DPOs said they had the skills and knowledge to do their work, received regular training, had clearly defined tasks, and did not receive instructions on how to carry them out. The EDPB still noted that too many DPOs were not in that position.

A DPO needs a defined role, enough time, and direct access to senior management, and combining the role with other heavy duties undermines all three. The report encourages organisations to give DPOs the time, resources, and opportunity to keep their knowledge current. In smaller organisations, an external DPO can provide the expertise. See our Data Protection Officer service.

3. Forgetting the Data You Hold About Your Own People

Data protection programmes often start with customers and stop there. Employees, job applicants, contractors and former staff are individuals too, and their data falls under the same rules. The EDPB’s guidelines on the right of access give an employment example: an employee’s general request could cover login data, workplace access records, canteen settlements, and salary data, showing how many systems hold staff information.

The fix is to map all the personal data your organisation processes, including HR files, recruitment folders, access logs and email, and to record it in your Article 30 record of processing activities. Check who can open each store. A folder of CVs that anyone in the company can read creates a security and access-control problem and a documentation gap.

4. Leaving Retention, Back-ups and Anonymisation Undefined

The 2026 erasure report lists seven recurring issues. Beyond missing procedures, training, and information, it names the misuse of, and legal uncertainty about, the exceptions used to refuse erasure; difficulties defining and implementing retention periods; deletion of personal data in back-ups; and difficulties with anonymisation when used to answer an erasure request.

The EDPB reports that some controllers relied on anonymisation techniques that did not effectively replace deletion. It also noted inconsistent practices across the EEA on retention periods and on erasure from back-ups. The EDPB assessed the overall compliance level of the responding controllers as average.

The fix is a retention schedule that sets a period for each data category with a stated reason, a deletion routine that covers backups or explains how backups are overwritten on a fixed cycle, and a test of any anonymisation method before using it as a substitute for deletion. If a record cannot be erased because a legal exception applies, record the exception and the reasoning.

5. Missing the 72-Hour Breach Deadline

Article 33 requires a controller to notify the supervisory authority of a personal data breach without undue delay and, where feasible, no later than 72 hours after becoming aware of it, unless the breach is unlikely to pose a risk to people. If the notification comes after 72 hours, it must explain the delay. Article 34 requires the controller to notify affected individuals directly only when the breach is likely to result in a high risk to them. Article 33(5) requires documenting every breach, including those not reported.

The authority is notified of breaches that carry a risk, and individuals are notified of breaches that carry a high risk.

The fix is a breach procedure that staff can use on the first day. It should say who to tell internally, who decides whether the breach is reportable, who contacts the authority, and where the breach register is kept. The 72 hours run from awareness, so the first hours decide whether the deadline can be met.

GDPRLocal helps organisations review procedures, resource DPO functions and prepare breach response. See our GDPR consultant services.

Conclusion

The common GDPR mistakes are practical. Organisations lack written procedures for requests, under-resource their DPO, forget the data they hold about their own staff, leave retention and backups undefined, and miss breach deadlines. Regulators across Europe have found each of these in their own investigations.

A short, current set of procedures covers most of them. Start with the request-handling procedure, since both recent EDPB reports found it missing; then set the DPO’s resources, complete the data map, define retention, and rehearse the breach process.

Frequently Asked Questions

What Is the Most Common GDPR Mistake?

The EDPB’s reports on the right of access and the right to erasure both found the lack of a documented internal procedure for handling data subject requests. A written process with named owners and trained staff is the most useful first fix.

Does Every Organisation Need a Data Protection Officer?

No. Article 37 makes a DPO mandatory in specific cases: public authorities; organisations whose core activities involve large-scale, regular, and systematic monitoring of people; and organisations whose core activities involve large-scale processing of special category or criminal offence data. Where a DPO is designated, the role needs resources and independence.

How Quickly Must a Data Breach Be Reported?

Where the breach is likely to result in a risk to people, report it to the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it. A late report must explain the delay. Individuals are told directly when the risk to them is high.

Disclaimer: This blog post is intended solely for informational purposes. It does not offer legal advice or opinions. This article is not a guide for resolving legal issues or managing litigation on your own. It should not be considered a replacement for professional legal counsel and does not provide legal advice for any specific situation or employer.